reslop 0.1.7 → 0.1.8

package/lib/deps/rows.js

@@ -0,0 +1,177 @@
+'use strict';
+
+const { countSides, isCtxType } = require('../diff.js');
+
+const DEP_CAPTION = 'Dependencies in package.json & package-lock.json';
+
+const changeMarks = (change) => {
+  const marks = [];
+  if (change.unused) marks.push('unused');
+  if (change.outdated && !change.propose) marks.push('outdated');
+  if (change.audit) marks.push(change.audit.severity);
+  return marks;
+};
+
+const changeSources = (change) => {
+  const sources = [];
+  if (change.unused) {
+    sources.push('npm uninstall');
+    return sources;
+  }
+  if (change.propose && change.outdated) sources.push('npm outdated');
+  if (change.audit) sources.push('npm audit');
+  return sources;
+};
+
+const sectionTitle = (section, action, marks, sources) => {
+  const title = action === 'changed' ? 'version changed' : action;
+  const kind = section.replace(/ies$/, 'y');
+  let label = `${kind} ${title}`;
+  if (section === 'field') label = `package.json ${title}`;
+  if (section === 'resolved' && action === 'vulnerable') {
+    label = 'lockfile vulnerable';
+  } else if (section === 'resolved') {
+    label = `lockfile resolved ${title}`;
+  }
+  if (marks.includes('unused')) {
+    label = `${kind} unused`;
+    const extra = [];
+    for (const mark of marks) {
+      if (mark !== 'unused') extra.push(mark);
+    }
+    if (extra.length) label = `${label}, ${extra.join(', ')}`;
+  } else if (marks.length) {
+    label = `${label}, ${marks.join(', ')}`;
+  }
+  if (!sources.length) return label;
+  return `${sources.join(', ')}: ${label}`;
+};
+
+const entryText = (change, side) => {
+  const version = side === 'old' ? change.from : change.to;
+  return `"${change.name}": "${version}"`;
+};
+
+const ctxLine = (text) => {
+  const type = 'ctx';
+  return { type, text };
+};
+
+const warnLine = (text) => {
+  const type = 'warn';
+  return { type, text };
+};
+
+const noteLine = (text) => {
+  const type = 'note';
+  return { type, text };
+};
+
+const noteSepLine = () => {
+  const type = 'noteSep';
+  const text = '';
+  return { type, text };
+};
+
+const changeLine = (type, change, side) => {
+  const text = entryText(change, side);
+  return { type, text };
+};
+
+const pushChangeLines = (rows, change) => {
+  if (change.unused) {
+    const side = change.action === 'added' ? 'new' : 'old';
+    rows.push(changeLine('del', change, side));
+    return;
+  }
+  if (change.action === 'added') {
+    rows.push(changeLine('add', change, 'new'));
+    return;
+  }
+  if (change.action === 'removed') {
+    rows.push(changeLine('del', change, 'old'));
+    return;
+  }
+  if (change.from === change.to) {
+    rows.push(changeLine('ctx', change, 'old'));
+    return;
+  }
+  rows.push(changeLine('del', change, 'old'));
+  rows.push(changeLine('add', change, 'new'));
+};
+
+const lockCountText = (oldCount, newCount) => {
+  if (oldCount === newCount) return '';
+  return `lockfile packages  ${oldCount} → ${newCount}`;
+};
+
+const auditNoteTexts = (audit) => {
+  if (!audit) return [];
+  const notes = [];
+  if (Array.isArray(audit.titles)) {
+    for (const note of audit.titles) {
+      if (note && !notes.includes(note)) notes.push(note);
+    }
+  } else if (audit.title) {
+    notes.push(audit.title);
+  }
+  const severity = audit.severity;
+  if (!notes.length) return [`npm audit  ${severity}`];
+  const texts = [];
+  for (const note of notes) {
+    texts.push(`npm audit  ${severity}  ${note}`);
+  }
+  return texts;
+};
+
+const pushAuditNotes = (rows, audit) => {
+  const texts = auditNoteTexts(audit);
+  if (!texts.length) return;
+  rows.push(ctxLine(''));
+  let first = true;
+  for (const text of texts) {
+    if (!first) rows.push(noteSepLine());
+    first = false;
+    rows.push(noteLine(text));
+  }
+};
+
+const buildRows = (change, oldCount, newCount) => {
+  const rows = [ctxLine(DEP_CAPTION), ctxLine('')];
+  if (change) {
+    const marks = changeMarks(change);
+    const sources = changeSources(change);
+    const title = sectionTitle(change.section, change.action, marks, sources);
+    const audited = sources.includes('npm audit');
+    rows.push(audited ? warnLine(title) : ctxLine(title));
+    rows.push(ctxLine(''));
+    pushChangeLines(rows, change);
+    pushAuditNotes(rows, change.audit);
+  }
+  const countLine = lockCountText(oldCount, newCount);
+  if (countLine) {
+    if (rows.at(-1).text !== '') rows.push(ctxLine(''));
+    rows.push(ctxLine(countLine));
+  }
+  if (!change && !countLine) rows.push(ctxLine('lockfile updated'));
+  return rows;
+};
+
+const toHunkLine = (row, blockId) => {
+  const type = row.type;
+  const text = row.text;
+  const noNl = false;
+  const id = isCtxType(type) ? null : blockId;
+  return { type, text, noNl, blockId: id };
+};
+
+const makeHunk = (rows, blockId) => {
+  const lines = rows.map((row) => toHunkLine(row, blockId));
+  const counts = countSides(lines);
+  const oldCount = counts.oldCount;
+  const newCount = counts.newCount;
+  const header = `@@ -1,${oldCount} +1,${newCount} @@`;
+  return { oldStart: 1, oldCount, newStart: 1, newCount, header, lines };
+};
+
+module.exports = { DEP_CAPTION, buildRows, makeHunk };

package/lib/deps/scan.js

@@ -0,0 +1,138 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const manifest = require('./manifest.js');
+const { MANIFEST, SECTION_KEYS, parseJson, readSections } = manifest;
+
+const usage = require('./usage.js');
+const { SOURCE_EXT, collectUsedFromText, collectUsedFromScripts } = usage;
+const { pkgHasExportEntry } = usage;
+
+const SKIP_WALK = ['node_modules', '.git', '.review', 'coverage', 'dist'];
+
+const collectUsedFromManifest = (used, rel) => {
+  let text;
+  try {
+    text = fs.readFileSync(rel, 'utf8');
+  } catch {
+    return;
+  }
+  const pkg = parseJson(text);
+  if (!pkg) return;
+  collectUsedFromScripts(used, pkg.scripts);
+};
+
+const walkUsedNames = (used, dir) => {
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.isSymbolicLink()) continue;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (SKIP_WALK.includes(entry.name)) continue;
+      if (entry.name.startsWith('.')) continue;
+      walkUsedNames(used, full);
+      continue;
+    }
+    if (entry.name === MANIFEST) {
+      collectUsedFromManifest(used, full);
+      continue;
+    }
+    const ext = path.extname(entry.name);
+    if (!SOURCE_EXT.includes(ext)) continue;
+    let text;
+    try {
+      text = fs.readFileSync(full, 'utf8');
+    } catch {
+      continue;
+    }
+    collectUsedFromText(used, text);
+  }
+};
+
+const collectUsedNames = (root) => {
+  const used = new Set();
+  if (!root) return used;
+  walkUsedNames(used, root);
+  return used;
+};
+
+const depModuleParts = (name) => {
+  if (!name.startsWith('@')) return [name];
+  const parts = name.split('/');
+  if (parts.length < 2) return [];
+  return parts.slice(0, 2);
+};
+
+const readDepPkg = (root, pkgDir, name) => {
+  if (!root || !name) return null;
+  const parts = depModuleParts(name);
+  if (!parts.length) return null;
+  const nested = pkgDir && pkgDir !== '.' ? pkgDir : '';
+  let dir = nested ? path.join(root, nested) : root;
+  while (true) {
+    const file = path.join(dir, 'node_modules', ...parts, MANIFEST);
+    let text = '';
+    try {
+      text = fs.readFileSync(file, 'utf8');
+    } catch {
+      // Missing node_modules copy; try a parent directory.
+    }
+    if (text) return parseJson(text);
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+};
+
+const depHasExportEntry = (root, pkgDir, name) => {
+  const pkg = readDepPkg(root, pkgDir, name);
+  if (!pkg) return true;
+  return pkgHasExportEntry(pkg);
+};
+
+const collectExportEntries = (root, pkgDir, names) => {
+  const entries = new Map();
+  if (!root) return entries;
+  for (const name of names) {
+    const hasExport = depHasExportEntry(root, pkgDir, name);
+    entries.set(name, hasExport);
+  }
+  return entries;
+};
+
+const declaredDepNames = (root, pkgDir) => {
+  const nested = pkgDir && pkgDir !== '.' ? pkgDir : '';
+  const file = path.join(root, nested, MANIFEST);
+  let text;
+  try {
+    text = fs.readFileSync(file, 'utf8');
+  } catch {
+    return [];
+  }
+  const maps = readSections(parseJson(text));
+  const names = [];
+  for (const key of SECTION_KEYS) {
+    for (const name of maps[key].keys()) names.push(name);
+  }
+  return names;
+};
+
+const collectExportMeta = (root, extra = {}) => {
+  if (extra.exportEntries !== undefined) return extra.exportEntries;
+  const pkgDir = extra.dir ?? '.';
+  const names = extra.names ?? declaredDepNames(root, pkgDir);
+  return collectExportEntries(root, pkgDir, names);
+};
+
+module.exports = {
+  collectUsedNames,
+  collectExportEntries,
+  collectExportMeta,
+};

package/lib/deps/usage.js

@@ -0,0 +1,68 @@
+'use strict';
+
+const SOURCE_EXT = ['.js', '.mjs', '.cjs', '.ts', '.mts', '.cts'];
+const REQUIRE_SPEC = /require\(\s*['"]([^'"]+)['"]\s*\)/g;
+const FROM_SPEC = /\bfrom\s+['"]([^'"]+)['"]/g;
+const IMPORT_FILE = /import\s+['"]([^'"]+)['"]/g;
+const IMPORT_CALL = /import\(\s*['"]([^'"]+)['"]\s*\)/g;
+
+const toPackageName = (spec) => {
+  if (!spec || spec.startsWith('.') || spec.startsWith('/')) return '';
+  if (spec.startsWith('node:')) return '';
+  if (spec.startsWith('@')) {
+    const parts = spec.split('/');
+    if (parts.length < 2) return '';
+    return `${parts[0]}/${parts[1]}`;
+  }
+  return spec.split('/')[0];
+};
+
+const addSpec = (used, spec) => {
+  const name = toPackageName(spec);
+  if (name) used.add(name);
+};
+
+const addMatches = (used, text, pattern) => {
+  const matches = text.matchAll(pattern);
+  for (const match of matches) addSpec(used, match[1]);
+};
+
+const collectUsedFromText = (used, text) => {
+  addMatches(used, text, REQUIRE_SPEC);
+  addMatches(used, text, FROM_SPEC);
+  addMatches(used, text, IMPORT_FILE);
+  addMatches(used, text, IMPORT_CALL);
+};
+
+const collectUsedFromScripts = (used, scripts) => {
+  if (!scripts || typeof scripts !== 'object') return;
+  for (const script of Object.values(scripts)) {
+    const tokens = `${script}`.split(/[\s;&|]+/);
+    for (const token of tokens) {
+      if (!token || token.startsWith('-')) continue;
+      if (token === 'npx' || token === 'npm' || token === 'node') continue;
+      addSpec(used, token);
+    }
+  }
+};
+
+const pkgHasExportEntry = (pkg) => {
+  if (!pkg || typeof pkg !== 'object') return false;
+  const main = pkg.main;
+  if (typeof main === 'string' && main) return true;
+  const esm = pkg.module;
+  if (typeof esm === 'string' && esm) return true;
+  const exported = pkg.exports;
+  if (typeof exported === 'string' && exported) return true;
+  if (!exported || typeof exported !== 'object') return false;
+  if (Array.isArray(exported)) return exported.length > 0;
+  return Object.keys(exported).length > 0;
+};
+
+module.exports = {
+  SOURCE_EXT,
+  toPackageName,
+  collectUsedFromText,
+  collectUsedFromScripts,
+  pkgHasExportEntry,
+};

package/lib/deps/versions.js

@@ -0,0 +1,119 @@
+'use strict';
+
+const { SECTION_KEYS } = require('./manifest.js');
+
+const applyWantedRange = (declared, wanted) => {
+  if (!wanted) return declared ?? '';
+  if (!declared) return wanted;
+  if (/^(file:|git[+@:]|workspace:|https?:|npm:)/.test(declared)) {
+    return declared;
+  }
+  if (declared.includes(' ') || declared.includes('|')) return declared;
+  if (declared.includes('<') || declared.includes('>')) return declared;
+  const prefix = declared.startsWith('^') || declared.startsWith('~');
+  const mark = prefix ? declared[0] : '';
+  return `${mark}${wanted}`;
+};
+
+const findDeclared = (pkg, name, type) => {
+  if (type && SECTION_KEYS.includes(type)) {
+    const map = pkg[type];
+    if (map && typeof map[name] === 'string') {
+      return { section: type, version: map[name] };
+    }
+  }
+  for (const section of SECTION_KEYS) {
+    const map = pkg[section];
+    if (map && typeof map[name] === 'string') {
+      return { section, version: map[name] };
+    }
+  }
+  return null;
+};
+
+const VER_CORE = /^(\d+)\.(\d+)\.(\d+)/;
+
+const parseVer = (text) => {
+  const match = `${text}`.match(VER_CORE);
+  if (!match) return null;
+  const major = Number(match[1]);
+  const minor = Number(match[2]);
+  const patch = Number(match[3]);
+  return [major, minor, patch];
+};
+
+const fmtVer = (parts) => `${parts[0]}.${parts[1]}.${parts[2]}`;
+
+const cmpVer = (left, right) => {
+  if (left[0] !== right[0]) return left[0] - right[0];
+  if (left[1] !== right[1]) return left[1] - right[1];
+  return left[2] - right[2];
+};
+
+const bumpPatch = (parts) => {
+  const major = parts[0];
+  const minor = parts[1];
+  const patch = parts[2] + 1;
+  return [major, minor, patch];
+};
+
+const clauseUpper = (clause) => {
+  const pattern = /(<=?)\s*(\d+\.\d+\.\d+)/g;
+  const matches = clause.matchAll(pattern);
+  let best = null;
+  for (const match of matches) {
+    const op = match[1];
+    const parsed = parseVer(match[2]);
+    if (!parsed) continue;
+    if (best && cmpVer(parsed, best.ver) >= 0) continue;
+    best = { op, ver: parsed };
+  }
+  return best;
+};
+
+const patchedFromRange = (current, range) => {
+  if (!current || !range) return '';
+  const now = parseVer(current);
+  if (!now) return '';
+  const clauses = `${range}`.split('||');
+  for (const clause of clauses) {
+    const upper = clauseUpper(clause);
+    if (!upper) continue;
+    if (now[0] !== upper.ver[0]) continue;
+    if (cmpVer(now, upper.ver) > 0) continue;
+    if (upper.op === '<') return fmtVer(upper.ver);
+    return fmtVer(bumpPatch(upper.ver));
+  }
+  return '';
+};
+
+const sameMajor = (from, to) => {
+  const left = parseVer(from);
+  const right = parseVer(to);
+  if (!left || !right) return false;
+  return left[0] === right[0];
+};
+
+const proposedLockVersion = (current, vul) => {
+  if (!current) return '';
+  if (!vul) return current;
+  const fix = vul.fix;
+  if (fix && sameMajor(current, fix) && fix !== current) return fix;
+  const patched = patchedFromRange(current, vul.range);
+  if (patched && patched !== current) return patched;
+  return current;
+};
+
+const proposedWanted = (out, vul) => {
+  if (out && out.wanted && out.wanted !== out.current) return out.wanted;
+  if (vul && vul.fix) return vul.fix;
+  return '';
+};
+
+module.exports = {
+  applyWantedRange,
+  findDeclared,
+  patchedFromRange,
+  proposedLockVersion,
+  proposedWanted,
+};